About Codebadger
Codebadger is an MCP server published by qcri in the Developer Tools category: 🦡 codebadger is a containerized Model Context Protocol (MCP) server that gives AI agents and LLMs deep, queryable access to a codebase's structure and data flow through Joern Code Property Graphs (CPGs).
The repository has 175 stars and 24 forks, with the last commit a month ago. Recent commit activity is the strongest signal that reported issues will get attention.
Install
git clone https://github.com/qcri/codebadgerThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Ask AI
Ask AI about Codebadger
Powered by Claude · Grounded in docs
Security checks
Static checks derived from the repository yesterday. Heuristics on the source, not an audit.
- ✓README presentThe repository ships documentation.
- ✓License declaredUsable under a stated license.
- ✓Tests presentA test suite exists in the repository.
- !Dependencies pinnedNo lockfile. Installs can pull different code over time.
- !No dynamic code executionSource scan found eval or shell execution. Review how tool inputs reach it before granting credentials.
- !Scoped permissionsDoesn't declare a permission scope. Assume it can do anything its process can.
Releases
README
🦡 codebadger
codebadger is a containerized Model Context Protocol (MCP) server that gives AI agents and LLMs deep, queryable access to a codebase's structure and data flow through Joern Code Property Graphs (CPGs).
Point it at a Git repository, a local path, or even a pasted code snippet, and codebadger builds a CPG and exposes it over MCP — so an assistant can run CPGQL queries, trace data flow and taint, slice programs, and hunt for vulnerabilities across Java, C/C++, JavaScript, Python, Go, Kotlin, C#, Ghidra, Jimple, PHP, Ruby, and Swift.
It's a general-purpose foundation for both program analysis (understanding code structure, call graphs, and data flow) and vulnerability analysis (taint tracking, bug hunting, and PoC development) — useful for academic research as well as industry security and engineering work. It's built to scale to large analysis batches with per-CPG worker pools, memory-aware scheduling, and a Postgres/Redis backend.
News
codebadger and its paper - Bridging Code Property Graphs and Language Models for Program Analysis - were accepted at the Software Vulnerability Management Workshop @ ICSE 2026. 🎉
Documentation
Everything a developer or security researcher needs lives in docs/:
| Doc | What's in it |
|---|---|
| Installation | Prerequisites and a 5-minute local setup. |
| Usage | Connecting MCP clients, the tool catalog, and a researcher workflow. |
| LLM workflow guide | Recommended bounded tool sequence for agents. |
| Available Tools | Every MCP tool by category, with a description of what each does. |
| Configuration | config.yaml / env reference, telemetry. |
| Deployment | Postgres/Redis, memory sizing, shared vs pool, large batches. |
| Architecture | System design and diagrams. |
| Security | Threat model, trust boundaries, and production hardening. |
| Custom Tools | Add your own detectors. |
| Contributing | Dev setup, tests, and guidelines. |
| Roadmap | What's shipped and what's next. |
Found a vulnerability using codebadger?
We'd love to hear about it - open a PR adding it to TROPHIES.md (CVE ID, project, one-line description, date).
Citation
@inproceedings{lekssays2026bridging,
title={Bridging Code Property Graphs and Language Models for Program Analysis},
author={Lekssays, Ahmed},
booktitle={Proceedings of the 2026 IEEE/ACM 4th International Workshop on Software Vulnerability Management},
pages={33--40},
year={2026}
}
README fetched from the repository yesterday. The original is authoritative.